Attackers drained nearly $114 million in Bitcoin from more than 709 addresses through a Coldcard firmware flaw. The first sweep emptied roughly 500 wallets in 25 minutes. The flaw entered the codebase in March 2021 and remained publicly visible for more than five years.